1. Home
  2. Software
  3. MiniFast

MiniFast

MiniFast is a custom malware designed for long-term persistence and remote code execution. MiniFast is a modular malware suspected of being generated using artificial intelligence (AI). MiniFast was first observed in early-2026 and is a modified version of the MiniJunk framework. MiniFast has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

ID: S9052
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.0
Created: 24 September 2026
Last Modified: 01 October 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1134 .002 Access Token Manipulation: Create Process with Token

MiniFast has the ability to execute a process with elevated privileges using runas.[1]

Enterprise T1071 .001 Application Layer Protocol: Web Protocols

MiniFast has utilized HTTP POST, GET and PUT requests for communications with the C2.[1]

Enterprise T1560 .001 Archive Collected Data: Archive via Utility

MiniFast has the ability to archive files and directories using ZIP.[1]

Enterprise T1059 .003 Command and Scripting Interpreter: Windows Command Shell

MiniFast has executed commands using cmd.exe.[1]

Enterprise T1132 .001 Data Encoding: Standard Encoding

MiniFast has encoded C2 instructions with Base64.[1]

Enterprise T1005 Data from Local System

MiniFast has collected data from local files and directories on the victim device.[1]

Enterprise T1074 .001 Data Staged: Local Data Staging

MiniFast has the ability to move data within the victim machine.[1]

Enterprise T1140 Deobfuscate/Decode Files or Information

MiniFast has decoded Base64-encoded tasks from the C2.[1]
Enterprise T1041 Exfiltration Over C2 Channel

MiniFast has the ability to upload files over C2 communications.[1]

Enterprise T1083 File and Directory Discovery

MiniFast has listed files and folders within a specified directory.[1]

Enterprise T1070 .004 Indicator Removal: File Deletion

MiniFast has the ability to delete files and directories.[1]

Enterprise T1105 Ingress Tool Transfer

MiniFast has the ability to download additional files from C2.[1]

Enterprise T1680 Local Storage Discovery

MiniFast has enumerated logical drives on impacted devices.[1]

Enterprise T1036 .012 Masquerading: Browser Fingerprint

MiniFast has blended into network traffic by mimicking a Chrome browser using the following User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36.[1]
Enterprise T1027 .015 Obfuscated Files or Information: Compression

MiniFast has been delivered within a malicious zip file.[1]

Enterprise T1057 Process Discovery

MiniFast has the ability to check running processes and has returned process names and their PIDs. MiniFast has also checked its relative parent process.[1]

Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

MiniFast has created scheduled tasks using the name "WindowsSecurityUpdate."[1]

Enterprise T1489 Service Stop

MiniFast has the ability to terminate a process using its PID.[1]

Enterprise T1553 .002 Subvert Trust Controls: Code Signing

MiniFast has leveraged valid digital signatures from SSL[.]com to appear legitimate.[1]

Enterprise T1082 System Information Discovery

MiniFast has collected the victim's username, hostname and domain information.[1]
Enterprise T1033 System Owner/User Discovery

MiniFast has collected the username on targeted systems.[1]

Groups That Use This Software

ID Name References
G1059 NIMBUS MANTICORE

MiniFast has been affiliated with the cyber espionage threat group NIMBUS MANTICORE.[1]

References

  1. Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.